w7corp/easywechat · error · InvalidConfigException

token or aes_key cannot be empty.

Error message

token or aes_key cannot be empty.

What it means

Application::getEncryptor() needs both token and aes_key (the EncodingAESKey) to build the Kernel Encryptor used for encrypted callback messages. If either is missing from the account it throws InvalidConfigException, because safe-mode message handling is impossible without them. The values come from the 'token' and 'aes_key' keys of the config array.

Source

Thrown at src/OfficialAccount/Application.php:90

    public function setAccount(AccountInterface $account): static
    {
        $this->account = $account;

        return $this;
    }

    /**
     * @throws InvalidConfigException
     */
    public function getEncryptor(): Encryptor
    {
        if (! $this->encryptor) {
            $token = $this->getAccount()->getToken();
            $aesKey = $this->getAccount()->getAesKey();

            if (empty($token) || empty($aesKey)) {
                throw new InvalidConfigException('token or aes_key cannot be empty.');
            }

            $this->encryptor = new Encryptor(
                appId: $this->getAccount()->getAppId(),
                token: $token,
                aesKey: $aesKey,
                receiveId: $this->getAccount()->getAppId()
            );
        }

        return $this->encryptor;
    }

    public function setEncryptor(Encryptor $encryptor): static
    {
        $this->encryptor = $encryptor;

        return $this;

View on GitHub (pinned to f0cf0a8b83)

Solutions

1. Add both 'token' and 'aes_key' to the EasyWeChat config with the values from MP console → 基本配置
2. Verify the aes_key format (43-char EncodingAESKey) and that token matches the console exactly
3. Redeploy or clear the config cache so the new values are picked up

Example fix

// before
$config = ['app_id' => 'wx1234', 'secret' => '...'];

// after
$config = [
    'app_id'  => 'wx1234',
    'secret'  => '...',
    'token'   => env('WECHAT_TOKEN'),
    'aes_key' => env('WECHAT_AES_KEY'),
];

foreach (['token', 'aes_key'] as $key) {
    if (blank($app->getConfig()->get($key))) {
        throw new \RuntimeException("EasyWeChat config missing '{$key}', required for encrypted callbacks.");
    }
}

try {
    $app->getEncryptor();
} catch (\EasyWeChat\Kernel\Exceptions\InvalidConfigException $e) {
    // degrade: disable the callback route instead of serving it misconfigured
    abort(503, 'callback encryption not configured');
}

When it happens

Trigger: Calling $app->getServer()->serve() (or getEncryptor()) on an Application configured with only app_id/secret while the MP console is set to secure or compatible message mode; receiving encrypted push messages after an API-only deployment.

Common situations: Config written for outbound API calls only, later a webhook/message route is added; EncodingAESKey copied with a typo or truncated (it is 43 characters); wrong key names ('aesKey', 'encoding_aes_key'); production .env missing the keys while local has them.

Related errors

• No secret configured.
• Encrypted message is required, plaintext message rejected.
• The token is required to validate the request signature, ple
• -40006
• -40005

AI-assisted analysis of w7corp/easywechat@f0cf0a8b83 (2026-08-21). Data as JSON: /api/errors/e8c3873c41536b9f. Report an issue: GitHub.